2FA and PGP keys.

I have all my accounts setup to require the key to unlock the account meaning that if anyone gets my password they still need the physical device to access my accounts.

My servers also only allow login via SSH by PGP key so, again you need the physical key to compromise my servers.